Malicious PDF — malware analysis report

Static analysis result for SHA-256 b83e08dce137be9e…

MALICIOUS

PDF

93.5 KB Created: 2021-03-15 01:32:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 48a780bb62aa43f9032b63815cf42d3f SHA-1: 7fad5530de7ad2bb0a634fbec734a305b77b59c0 SHA-256: b83e08dce137be9e02064c33df7a77a267dbcd3d1c694805ee82744285b92dc8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'ponafet.ru', which is likely used to redirect the user to a malicious site. The document body, though heavily obfuscated, appears to be a lure related to 'types of metals and their properties'. The presence of multiple embedded URLs suggests an attempt to distribute further malicious content or conduct phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=tipos+de+metales+y+sus+propiedades
    • http://gnfcns.info/semidutonuvezokezec8hle.pdf
    • http://cosmicgig.com/how_to_help_your_body_recover_from_smokingn7cko.pdf
    • http://phtech.site/nupanupirevaze9k2tv.pdf
    • http://tryraisins.pro/how_much_hp_does_a_lamborghini_gallardo_haveav58e.pdf
    • https://vonuvevija.weebly.com/uploads/1/3/1/4/131407152/9541cfc7.pdf
    • http://haustova.com/how_to_get_your_cursor_back_on_hp_laptop1wryr.pdf
    • https://sisuveraxom.weebly.com/uploads/1/3/2/7/132740665/sifamu_nevapemapat_mewutulimimex.pdf
    • http://haustova.com/test_htp_interpretacionoeb5u.pdf
    • https://fetavagipiw.weebly.com/uploads/1/3/1/3/131380759/dabufamasuvi.pdf
    • http://lg-copyrightforms.com/wibafanuvesi3f3is.pdf
    • http://deflecfcvy.best/cod_recipes_grilled_in_foil0e1r2.pdf
    • http://pesugesilufafa.iblogger.org/98653728322.pdf
    • https://jijobowuzum.weebly.com/uploads/1/3/4/5/134590228/wupetabomixapow.pdf
    • http://item-mask.top/16577168621f7nob.pdf
    • https://zorusijumabek.weebly.com/uploads/1/3/4/8/134851431/405123b27f6690d.pdf
    • http://menetufebev.22web.org/3457193706.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://sovupafol.epizy.com/93316889571.pdf
    • http://jajowisomipuw.epizy.com/wejujisenamerube.pdf
    • https://3c8197b3-f999-4f29-b3da-fbdfea3dbf34.filesusr.com/ugd/0047a4_e47af2dc121c4486b20baab00f5bf52c.pdf?index=true
    • https://aefb6378-f3ca-470a-b9d2-22936542d087.filesusr.com/ugd/fe129c_0fe31788c97d4677bfd25c88230a3fc8.pdf?index=true
    • http://digotadegijo.epizy.com/8845243581.pdf
    • https://4e33067b-0f13-4bed-bb9c-ea95f768fd7c.filesusr.com/ugd/23924c_fee2d095943848bf8e96876a22c19de5.pdf?index=true
    • https://b3079848-b07e-4d89-9244-05dfa5dd91fe.filesusr.com/ugd/3ab5ed_00999b4f19284d1c8e78a7c11d4985b6.pdf?index=true
    • http://xarugutivi.epizy.com/android_phone_under_5000_4g_volte.pdf
    • http://gofuwupe.epizy.com/tifijavarezoxofaki.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012a6e.bin
1daf79e9d947b5702287e120bb2ba7a2f931a7fbaf2084f8b27f94950c8edfb3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12A6E 5156 bytes
font_01_sfnt_off00013be3.bin
155eedca900ca06aa4f7d360285735107500dbb99f0f093e9919c6950a97611f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13BE3 13376 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.